Azure Backup Vaults & Security
Recovery Services vault · Backup vault · Soft delete · Immutability · MUA
Practice questions for this topic →
Which vault?
| Vault | Protects |
|---|---|
| Recovery Services vault | Azure VMs, SQL Server in VMs, SAP HANA in VMs, Azure Files, on-prem (MARS agent, MABS, DPM); also used by Azure Site Recovery |
| Backup vault | Managed disks, Azure Blobs, Azure Database for PostgreSQL flexible server, AKS |
A vault backs up resources in its own region only: one vault per region with VMs. VM backups run once a day (Standard policy); MABS/DPM twice; MARS three times a day.
Limits (support matrix)
| Limit | Value |
|---|---|
| Vaults per subscription | 500 (Recovery Services or Backup vaults) |
| Azure VMs per vault | 1,000 (only 250 VM registrations per day) |
| Data sources per vault | 2,000 across workloads |
| VMs per backup policy | 100 |
| MABS servers per vault | 50 |
Security features
| Feature | Does |
|---|---|
| Soft delete | Enforced by default where secure by default applies, so its state can't be modified in the Azure portal. Deleted data kept 14 days by default at no extra cost, extendable up to 180. Undelete returns an item to 'Stop protection with retain data'; recovery points aren't cleaned up while soft-deleted. Vaults are soft-deleted too |
| Immutable vault | Blocks operations that would remove recovery points (can be locked) |
| Multi-user authorization (Resource Guard) | Critical operations need approval from a different owner: put the Resource Guard in another subscription or tenant in the same region; the backup admin must not have Contributor on it. Disabling soft delete and removing MUA are mandatory protected operations; use PIM for just-in-time access |
| Backup RBAC roles | Backup Contributor, Backup Operator (no deleting backups or policy changes), Backup Reader |
| Customer-managed keys | Encrypt backup data with your keys |
| Private endpoints | Back up without public network exposure |
Microsoft's soft-delete page is inconsistent: its introduction says enforcement is in preview across all public regions for Recovery Services vaults, while its regions table lists Recovery Services vaults as generally available in all public regions and national clouds, and Backup vaults as generally available in Australia East, West Central US and East Asia and in preview elsewhere. Soft delete for vaults themselves is described as preview. Check the Learn page for your region.
Exam Tips
Tick each tip once you can answer it without looking.
“Back up Azure blobs, managed disks or PostgreSQL flexible server” → Backup vault.
“Back up VMs, SQL in VMs, Azure Files or on-prem servers” → Recovery Services vault.
“VMs in East US and West Europe need backup” → One vault in each region. Trap: A vault can't back up VMs from another region.
“A compromised admin must not be able to delete backups or lower retention alone” → Multi-user authorization with Resource Guard (owned by a different team/tenant).
“Backups must not be deletable before retention ends (ransomware)” → Immutable vault (locked) + soft delete (enforced by default).
“Recover backup data an admin deleted yesterday” → Soft delete (14 days by default, extendable up to 180).
“Operator can run backups/restores but not delete backups or change policies” → Backup Operator role.
“Back up files and folders from an on-prem Windows server directly to Azure” → MARS agent → Recovery Services vault.
“Monitor backup and ASR across all vaults and subscriptions” → Azure Business Continuity Center / Backup reports.
“Maximum soft-delete retention for Azure Backup” → 180 days (14 by default); a soft-deleted vault is recoverable too. Trap: Recovery points aren't cleaned up while an item is soft-deleted.
“Restore a soft-deleted Azure Backup item” → It returns to Stop protection with retain data; then restore or resume backups. Trap: Soft-delete retention is 14 days by default, up to 180; secure by default stops you changing it in the portal in covered regions.